Kozhikode: Two college students from Kerala -- entangled in a cyber crime they had little role in -- are languishing in Punjab's Central Jail in Patiala district for more than nine months. Their bail petitions have been rejected four times -- twice by the additional sessions court at Mohali in Sahibzada Ajit Singh (SAS) Nagar district, and twice by the High Court of Punjab and Haryana in Chandigarh. 

Shahal P (24) and Suroor E (26) of Vailathur, 4km from Tirur town in Malappuram district, were arrested by Punjab Police on August 11, 2023. They are accused of being part of a cybercrime gang that duped a doctor in Mohali of Rs 61.82 lakh. 

Their case painfully exposes cyber police's inadequate expertise in investigating cybercrimes and the courts' lack of understanding of the cryptocurrency world, say their families and advocates. The case also, importantly, highlights the hazards of loaning one's bank account to others to receive their money.

Two days before the two college students were arrested, Punjab police on August 9, 2023, arrested Suresh Kumar (51), an acute diabetic with a foot injury, and Manoop from Kondotty police station limits in Malappuram district. They are lodged in the same prison as the college students. "Suresh Kumar was recently hospitalised after his blood sugar shot up. Manoop stayed in the hospital as his caregiver. But now they are back in the prison," said Shabeer E, the eldest brother of Suroor, who is in Dubai.

Suroor is also breaking down, he said. "I don't think he can survive in prison anymore. We are in touch with our lawyers in Punjab to approach the Supreme Court for bail," said Shabeer.

The scam
On August 4, 2023, Dr Sonia Ghuman, the chief medical officer of a government hospital in Mohali, got a phone call from a person claiming to be an executive from the FedEx courier company. He told Dr Ghuman that the parcel she sent to Taiwan was impounded at Mumbai airport because it had 150g of MDMA psychoactive drug. 

She had sent no parcel to anyone yet the fraudster managed to strike panic in her by revealing her Aadhaar number and full name found on the non-existing parcel.

The executive then transferred the call to the 'Narcotics Division' of Mumbai police. The Narcotics Division officer moved the conversation to Skype and made her sign a confidentiality agreement saying she would not discuss the case with anyone. He also made her sign an acknowledgement letter from CBI which said she would transfer 98% of her money in all her accounts to the 'Reserve Bank of India' for verification.

The 'officer' assured her that RBI would transfer back the money if the money was not linked to any fraud. 

Isolated in a bubble of fear, Dr Ghuman, on the same day, that is August 4, 2023, transferred Rs 55.95 lakh from her account with HDFC Bank to the ICICI Bank account given by the fraudsters. She then transferred another Rs 5.17 lakh from the joint account with her mother Sukhpal Kaur to the same ICICI Bank account of the fraudster.

On August 5, the fraudster pressed Dr Ghuman to transfer another Rs 8.5 lakh. The excessive pressure made her realise she was being taken for a ride and she approached the Cyber Crime Police Station in Mohali.

Fraudsters then target crypto traders
The day Dr Sonia Ghuman lost Rs 61.12 lakh, Shabeer, a crypto trader sitting in Dubai, got a request from one Yupeng Wang for Rs 3 lakh worth of USDT on the Binance trading platform. 
USDT, or US dollar Tether, is a type of cryptocurrency whose value is pegged to the US dollar, making it more stable and preferred than cryptocurrencies.

Shabeer said his bank accounts were blocked, so he asked his younger brother Suroor back home to find him a bank account that could receive Rs 3 lakh in Indian currency. Suroor reached out to Shahal, his Plus 2 classmate for help. "Shahal asked me if he should help Suroor. I said no," Shahal's mother and homemaker Sulaikha Saleem told Onmanorama. "Why give our bank account to others and get into trouble." But Shahal prevailed over his mother saying banking transactions meant the money was clean and zero trouble.

Soon, Shahal received Rs 3,07,006 in his bank account. And Shabeer transferred USDT worth the same amount to the account of Yupeng Wang, the buyer, on Binance.

On the same day, Suresh Kumar also received Rs 9,99,999 in his bank account. He too was helping a crypto trader receive Indian currency. But unlike Shahal, Suresh Kumar was doing it for a small commission.

Punjab police come calling
Punjab police, relying on the money trail statements from the banks, landed in Malappuram. They said the money that reached Shahal and Suresh Kumar's bank accounts was proceeds from the fraud played on Dr Sonia Ghuman from Mohali. 

Punjab Police first first picked up Suresh Kumar on August 9, 2023. Later, they picked up Manoop because they reportedly saw CCTV footage from the bank in which Manoop was helping Suresh Kumar fill out the withdrawal form. Later, they picked up Shahal from his home in Tirur on August 11, 2023. 

CCTV footage from Canara Bank's Vailathur branch reportedly showed Shahal handing over Rs 2.70 lakh to Shabeer's brother Suroor. So police arrested Suroor, too, the same day. 

"Suroor was arrested four months after he joined an integrated MBA course in a university in Dubai," said his brother Shabeer. "As a crypto trader, how are we supposed to know the money we are receiving is linked to a scam," he said. 

Shahal was arrested one month before the fifth-semester exam of his BA English programme, said his mother Sulaikha. "The police should have thought of his education, at least," she said. She and her two other school-going children are dependent on the money Shahal brought home, working as a tile mason. 

Omissions in police investigation
Apart from the four Malappuram residents, Punjab police have arrested six more people in connection with the defrauding of Dr Sonia Ghuman. According to several defence counsels, police have accused the six of handling the primary ICICI Bank account to which Dr Ghuman transferred her life savings.

But that's not the whole story. Punjab Police have let off several people central to the scam, without much explanation, according to the remand report, court orders and advocates representing the accused. And courts have not questioned the omission either, said the advocates.

On August 4, 2024, Dr Ghuman transferred Rs 61.12 lakh to the ICICI Bank account of NK International, owned by one N Nikhil Kumar. 

On the same day, Rs 58.35 lakh from that account is transferred to three Yes Bank accounts, according to the money trail. Calendar House owned by Sourob Janti Singh Mumbai got Rs 10 lakh, Shree Nakoda International owned by Kamaljit in Jaipur got Rs 17.62 lakh, and Rajendra Metal owned by Amrat Kumar in Mumbai got Rs 30.73 lakh.

Punjab police have not named the four persons or their entities -- the direct beneficiaries of the fraud -- as accused in the case. 
On August 4, Amrat Kumar-owned Rajendra Metal transfers Rs 3.07 lakh to Shahal's Canara Bank account, and Rs 9,99,999 to Suresh Kumar's account. 

Punjab police arrested the two and their friends, Suroor and Manoop, respectively, and made them accused in the case.

Renting account for a fee 
Though NK International's account holder Nakrani Nikhil Kumar was not made an accused, he joined the probe on August 13, 2023. According to the charge sheet details shared by the defence lawyers, Nakrani Nikhil Kumar reportedly told the police that he gave his bank account username, password, and SIM of the registered phone number to his friend Jaydeep Rathore.

Police arrested Rathore on August 14, 2023. He reportedly told the police that he sold the bank account to Bhojubhai Chopda for a 10% commission on all transactions. 
Police arrested Chopda the same day. But he reportedly told police that he sold the account for a commission of Rs 45,000 flat to Vala Ravi Sureshbhai. 

According to police reports, Bhojubhai Chopda received Rs 20,000 in his account, and Rs 25,000 in his friend's account.

Vala Ravi Sureshbhai was also arrested on August 14, 2023. He reportedly told police that he sold the bank account to Davra Grivin Dilipbhai for a commission of Rs 90,000. He received Rs 20,000 through a Paytm account.

Dilipbai was arrested on September 2, 2023. He reportedly sold the bank account to Dobariya Jaydip alias Jasmin for a commission of Rs 1 lakh. Dobariya Jaydip was reportedly the sixth handler of the original ICICI Bank account which received Rs 61.12 lakh from Dr Sonia Ghuman.

Jasmin was arrested on September 3, 2023. According to police, Jaydip used the SIM of the registered phone number of NK International's bank account in his phone from August 1 to August 5, 2023. This was the window in which that account received money and transferred out money. But Jaydip is not the main accused in the case either.

He reportedly told police that he sold the ICICI Bank account to one Ishtiyaq Ahmad Thoker for a commission of Rs 1.20 lakh.

According to police documents, Jaydip received payment against his Binance ID from Ishtiyaq Ahmad Thoker. Now only USDT or cryptocurrency can be credited to Binance ID. But the police have not delved into the cryptocurrency angle, said Thoker's counsel Satnam Singh Gill, who has been an advocate in the High Court of Punjab and Haryana for 30 years. 

Ishtiyaq Ahamed, the seventh handler of the account, was also arrested on September 14, 2023. According to police, he reportedly sold the bank account to an anonymous user on the Telegram messaging app. 

The police investigation is stalled at this point. Except for the original owner of the account, police named all six persons who controlled the account as accused in the case. "Police have not explained why the original account holder was not named as an accused," said Adv Gill. 

Cyber activist and All India Virtual Asset Traders' Association general secretary Abdul Jabbar V H said police could have found out the beneficiary of the fraud by questioning the first and second-level recipients of the money. "There is a high chance that the fraudsters converted the money to cryptocurrency. The money transferred to the three Yes Bank accounts could be in exchange for USDT," he said, and added that the police should have grilled the owners of the three Yes Bank accounts to find who and why the money was transferred to their accounts.

If cryptocurrency is involved, police could track down the buyers because all traders -- buyers and sellers -- are KYC-compliant on trading platforms such as Binance. "Also Telegram is also not an anonymous platform and police can find the buyer of the account. They have to know how to do it," said Jabbar.

Crypto angle not pursued
However, the police have not considered the cryptocurrency angle at all. "We have submitted all documents to prove that the money we received in our account was in exchange for the USDT sold on Binance. It was not the proceeds of the fraud we did. But Punjab Police refused to see them," said Shabeer. 

Neither have the police looked into mule accounts such as the one owned by Nikhil Kumar. "After Dr Sonia Ghuman lost Rs 61 lakh and reported Nikhil Kumar's account to police, the same account saw transactions worth Rs 1.75 crore. Police have no answers to that," said Adv Gill.

Onmanorama found that Chhattar Singh of Amer in Jaipur transferred Rs 10.11 lakh to Nikhil Kumar's account on August 4, the same day Dr Ghuman lost her money. Chhattar Singh has filed a police complaint saying he lost his money in an online earning scam.

But police have picked and chosen the 10 accused in the case and charged them with cheating (Section 420 of IPC), extortion (Sections 383 & 384), forgery of court/ public records (Section 466), forgery for cheating (Section 468), forging documents or electronic record (Section 470), using forged documents as genuine (Section 471), criminal intimidation (Section 506), criminal conspiracy (Section 120B of IPC), and identity theft and impersonation using computer resource (Sections 66 C and 66 D of IT Act).

The police were seeing all the 10 accused as part of one gang, said Adv Ashir Gulati, the lead counsel for Suroor and Shahil. "Neither do my clients know the other accused nor did they have any communication with them," he said. 

"We wanted to highlight in court that those who received chunks of money from the account were not made an accused. But we were not heard," he said.

Adv Tarun Deora, another defence lawyer, said that the "police and judges here are not much aware of cryptocurrency. So they don't consider that angle". 

The trial in the case began on October 6, 2023. The past seven months saw 19 hearings. The next hearing is on May 24, when the prosecution will present the evidence. 

On April 29, the High Court rejected the bail application of Suroor and Shahil for the second time. But the commentary was telling. "Keeping in view the nature of allegations levelled against the petitioners, coupled with the fact that their illegal activities i.e. online fraud, are spread across the length and breadth of the country, as apprised by the learned State counsel, they do not deserve the concession of bail," said High Court Judge Manjari Nehru Kaul in her order.

Shabeer is footing the legal bill of his brother Suroor and their Shahil. But in the case of Suresh Kumar, the people of his village have raised money to hire a lawyer for him.